/
Navigation
C
Chronicles
Browse all articles
C
E
Explore
Semantic exploration
E
R
Research
Entity momentum
R
N
Nexus
Correlations & relationships
N
~
Story Arc
Topic evolution
S
Drift Map
Semantic trajectory animation
D
P
Posts
Analysis & commentary
P
Browse
@
Entities
Companies, people, products, technologies
Domains
Browse by publication source
Handles
Browse by social media handle
Detection
?
Concept Search
Semantic similarity search
!
High Impact Stories
Top coverage by position
+
Sentiment Analysis
Positive/negative coverage
*
Anomaly Detection
Unusual coverage patterns
Analysis
vs
Rivalry Report
Compare two entities head-to-head
/\
Semantic Pivots
Narrative discontinuities
!!
Crisis Response
Event recovery patterns
Connected
Nav: C E R N
Search: /
Command: ⌘K
Embeddings: large
VOICE ARCHIVE

@arekfurt

@arekfurt
99 posts
2025-06-03
Okay, so it's kind of confusing as to what exactly “deconfliction” on threat actor names between Microsoft and CrowdStrike means here. Does it mean that from now they will cooperatively decide whether some activity should be attributed to a group? https://www.crowdstrike.com/ ... [image]
2025-06-03 View on X
Reuters

Microsoft, Google, CrowdStrike, and Palo Alto Networks plan to create a public glossary of state-sponsored hacking groups to ease unofficial alias confusion

Microsoft, CrowdStrike, Palo Alto (PANW.O) and Alphabet's (GOOGL.O) Google on Monday said they would create a public glossary …

2024-12-12
Fascinating stuff: https://www.microsoft.com/... [image]
2024-12-12 View on X
TechCrunch

Microsoft says Russia-backed hacking group Secret Blizzard targeted Ukraine's military using other cybercriminals' tools, “to make attribution more difficult”

A Russian-government backed hacking group targeted Ukraine's military using tools and infrastructure developed by cybercriminals, according to new research.

2024-12-04
This paragraph about how Salt Typhoon state or state-affiliated attackers from China managed to blow past the defenses of enormous U.S. telcos shouldn't shock you. But (if you're an American) it absolutely should make you really, really angry: https://www.cisa.gov/... [image]
2024-12-04 View on X
Axios

The FBI and CISA give US telcos best practices to harden their systems against attacks, as senior US officials say Salt Typhoon hackers remain on their networks

- Officials added that they don't yet know the full scope of the intrusions, despite starting the investigation in late spring.

This paragraph about how Salt Typhoon state or state-affiliated attackers from China managed to blow past the defenses of enormous U.S. telcos shouldn't shock you. But (if you're an American) it absolutely should make you really, really angry: https://www.cisa.gov/... [image]
2024-12-04 View on X
NBC News

Amid the Salt Typhoon hacks, US officials recommend that Americans use encrypted messaging apps to ensure their communications stay hidden from foreign hackers

Stop Sending Texts Jonny Evans / Computerworld : The FBI now says encryption is good for you  —  Apple has been battling to maintain encryption for a decade. Cynthia B Brumfield / ...

2024-11-24
Finally, some useful technical details here on the Salt Typhoon PRC telecom hacks. Wiretap collection systems themselves appear to have not been compromised. OTOH, as many suspected the scope of contact log theft seems to be in the millions of users. https://www.washingtonpost.com/ ... [image]
2024-11-24 View on X
New York Times

Senate Intelligence Committee Chairman Mark Warner says China-linked Salt Typhoon group listened to phone calls and read texts by hacking US telecom networks

https://www.nytimes.com/... Bluesky: @anarcish.bsky.social : For the entire history of information technology security experts have warned that once you make a back door to allow t...

Finally, some useful technical details here on the Salt Typhoon PRC telecom hacks. Wiretap collection systems themselves appear to have not been compromised. OTOH, as many suspected the scope of contact log theft seems to be in the millions of users. https://www.washingtonpost.com/ ... [image]
2024-11-24 View on X
New York Times

Sources: the US government launched an investigation into the Salt Typhoon hack after Microsoft alerted it and telecom companies about anomalies

Leaders of the big telecommunications companies were summoned to the White House to discuss strategies for overhauling the security …

2024-08-07
There are at minimum two or three separate ways this fact pattern represents astoundingly basic technical failure for a company that makes a product as important as CrowdStrike Falcon is.
2024-08-07 View on X
The Register

CrowdStrike shares a root cause analysis of the July 19 outage, and says it hired two third-party security firms to review its Falcon threat-detection suite

And reveals the small mistake that bricked 8.5M Windows boxes  —  CrowdStrike has hired two outside security firms to review …

As l've said before regarding some other firms, I think CrowdStrike does deserve some credit for at least admitting in it postmortems how badly it screwed up technically. And boy, did it screw up technically: A sensor config file having one extra field was enough for a disaster. [image]
2024-08-07 View on X
The Register

CrowdStrike shares a root cause analysis of the July 19 outage, and says it hired two third-party security firms to review its Falcon threat-detection suite

And reveals the small mistake that bricked 8.5M Windows boxes  —  CrowdStrike has hired two outside security firms to review …

(For example: The update content verifier didn't even check that the number of fields the update had was no greater than the maximum it should have before the update went out? For real?)
2024-08-07 View on X
The Register

CrowdStrike shares a root cause analysis of the July 19 outage, and says it hired two third-party security firms to review its Falcon threat-detection suite

And reveals the small mistake that bricked 8.5M Windows boxes  —  CrowdStrike has hired two outside security firms to review …

2024-07-24
Crowdstrike has now released an initial post-mortem and set of lessons learned. The big takeaway: CS did not actually test the specific sensor config update in question. Instead, it relied on a content validator + lack of problems with similar updates. https://www.crowdstrike.com/ ... [image]
2024-07-24 View on X
The Register

CrowdStrike says the problematic July 19 software update that brought down 8.5M Windows PCs was deployed into production due to “a bug in the Content Validator”

CrowdStrike has blamed a bug in its own test software for the mass-crash-event it caused last week.

2024-07-22
If you haven't seen it, per Crowdstrike here's the concise explanation on how its bad updates actually wound up breaking Windows: (No more official technical detail at this time on what the “logic error” actually did at low-levels.) https://www.crowdstrike.com/ ... [image]
2024-07-22 View on X
Reuters

Reeling from CrowdStrike-related outages, Delta has canceled 5,000+ flights, including 1,384 on Sunday and 700+ for Monday so far, according to FlightAware

Delta Air Lines (DAL.N) struggled to restore normal operations on Sunday after last week's crippling global cyber outage …

If you haven't seen it, per Crowdstrike here's the concise explanation on how its bad updates actually wound up breaking Windows: (No more official technical detail at this time on what the “logic error” actually did at low-levels.) https://www.crowdstrike.com/ ... [image]
2024-07-22 View on X
CrowdStrike

CrowdStrike says a Falcon sensor configuration update on Windows triggered a logic error that resulted in a system crash and BSOD, remediated after 78 minutes

Thankfully, Macs weren't affected by last week's catastrophic … Anthony Ha / TechCrunch : TechCrunch Minute: What caused last week's major tech outage? CrowdStrike : Likely eCrime ...

2024-07-21
If you haven't seen it, per Crowdstrike here's the concise explanation on how its bad updates actually wound up breaking Windows: (No more official technical detail at this time on what the “logic error” actually did at low-levels.) https://www.crowdstrike.com/ ... [image]
2024-07-21 View on X
CrowdStrike

CrowdStrike says a sensor configuration update to Windows systems triggered a logic error that resulted in a system crash and BSOD on impacted systems

What Happened?  —  On July 19, 2024 at 04:09 UTC, as part of ongoing operations, CrowdStrike released a sensor configuration update to Windows systems.

If you haven't seen it, per Crowdstrike here's the concise explanation on how its bad updates actually wound up breaking Windows: (No more official technical detail at this time on what the “logic error” actually did at low-levels.) https://www.crowdstrike.com/ ... [image]
2024-07-21 View on X
The Official Microsoft Blog

Microsoft estimates that CrowdStrike's update affected 8.5M Windows devices, or less than 1% of all Windows machines

On July 18, CrowdStrike, an independent cybersecurity company, released a software update that began impacting IT systems globally.  Although this was not a Microsoft incident …

2024-07-13
The fact that news of something like the AT&T/Snowflake breach isn't in any way surprising shows us with disturbing clarity how deep in the shit we really are.
2024-07-13 View on X
404 Media

Sources: John Binns, a US citizen who has been incarcerated in Turkey and indicted for allegedly hacking T-Mobile in 2021, is linked to the AT&T data breach

across the breadth of America's second largest teleco. It's just awful. https://x.com/... Joseph Cox / @josephfcox : Scoop: John Binns, an American hacker in Turkey, is linked to t...

The CSRB would do well to investigate a selection of significant Snowflake-related breaches—including this AT&T thing—and examine exactly how and why major companies came to store sensitive info in such a service without MFA or client-side encryption being used to protect it.
2024-07-13 View on X
404 Media

Sources: John Binns, a US citizen who has been incarcerated in Turkey and indicted for allegedly hacking T-Mobile in 2021, is linked to the AT&T data breach

across the breadth of America's second largest teleco. It's just awful. https://x.com/... Joseph Cox / @josephfcox : Scoop: John Binns, an American hacker in Turkey, is linked to t...

2024-06-27
Progress says this is what is responsible for its shift in increasing the assessed severity of this month's MOVEIT vuln: 🤔🤔 [image]
2024-06-27 View on X
Ars Technica

Progress Software discloses a critical vulnerability in MOVEit's SFTP module; hackers exploited a similar flaw in MOVEit in 2023 to breach almost 1,800 networks

A similar flaw last year left 1,800 networks breached.  Will the latest one be as potent?  —  A critical vulnerability …

2024-06-13
This is one hell of a read. It should be said that susceptibility to Golden SAML attacks isn't a security vulnerability in AD FS in particular. Nor was the fact such attacks could happen surprising. It's more like people put 2 and 2 together to make 4. https://www.propublica.org/...
2024-06-13 View on X
ProPublica

Ex-employee Andrew Harris says Microsoft for years dismissed his warnings of an Active Directory flaw that led to the 2021 SolarWinds hack; Harris left in 2020

Microsoft hired Andrew Harris for his extraordinary skill in keeping hackers out of the nation's most sensitive computer networks.

2024-06-12
The PRC exploited 14,000 Fortigate devices before the vulnerability in question here was even announced. Just let that sink in. Mass intrusion campaigns by state actors abusing either perimeter 0days or supply chain backdoors have become reality.
2024-06-12 View on X
BleepingComputer

Dutch agencies: 20K+ FortiGate systems were hacked in a Chinese cyber-espionage campaign in 2022 and 2023, at least two months before FortiGate noted the flaw

Sergiu Gatlan / BleepingComputer :

In the incidents so far, relatively few targets (compared to the number initially compromised) have promptly seen follow-up malware deployment + follow-on intrusion activities. But...
2024-06-12 View on X
BleepingComputer

Dutch agencies: 20K+ FortiGate systems were hacked in a Chinese cyber-espionage campaign in 2022 and 2023, at least two months before FortiGate noted the flaw

Sergiu Gatlan / BleepingComputer :